Claude Code Permissions Kit: settings.json Presets, Rule Simulator and Policy Tests

Stop clicking "Yes" 200 times a day without handing Claude Code the keys to your machine. Eight tested settings.json presets, eleven allow/deny packs, an installer that merges into the settings you already have, a simulator that tells you exactly which rule allows, asks or denies a command, and policy tests you can run in CI.

Offline. Python 3.9+, no dependencies, no account, no network. Rules checked against the Claude Code permissions docs (November 2026).

./tools/demo.sh                                                     # tour: simulate, policy tests, lint, dry-run install
python3 tools/install.py --list                                     # presets and packs
python3 tools/install.py /path/to/repo --preset safe-default --pack node --dry-run
python3 tools/install.py /path/to/repo --preset safe-default --pack node   # writes .claude/settings.json (backup first)
python3 tools/simulate.py --project /path/to/repo "Bash: npm run build && git push origin main"

Packs (packs/): secrets-deny, destructive-deny, publish-ask, git-safe, node, python, go, rust, docker-readonly, gh-readonly, docs-fetch. Combine them with any preset: --pack go --pack docker-readonly.

Tools (tools/):

• install.py merges a preset/packs into project, local or user settings: adds and de-duplicates rules, keeps your other keys, only sets defaultMode if you have none, writes a timestamped backup, lints the result.
• simulate.py answers "allow, ask or deny - and which rule, from which file?" for Bash, Read, Edit, WebFetch and MCP calls, across managed/local/project/user scopes. --tests runs policy tests (JSON) and exits 1 on any failure.
• cc_lint.py flags rules that never match or are skipped (Write(path), mcp__x(...), Bash(git:* push), pipes in rules), over-broad allows (Bash(git *)), allows a deny always beats, bad modes and typo'd keys. Also free on its own as the Claude Code Settings Checker.

Docs (docs/): allowed-tools-syntax.md (cheat sheet), modes.md (auto vs acceptEdits vs bypass, and alternatives to skipping permissions), teams.md (scopes, managed settings, CI), limits.md.

{"preset": "presets/safe-default.json", "cwd": "/work/repo", "home": "/home/dev",
 "tests": [{"call": "Bash: git push origin main", "expect": "ask"},
           {"call": "Read: config/.env.production", "expect": "deny"}]}

python3 tools/simulate.py --tests my-policy.tests.json - point preset at your own .claude/settings.json.

./run_tests.sh: unit tests for the rule engine (wildcards, compound commands, wrappers, env prefixes, path anchors, WebFetch, MCP), all 45 policy tests, lint-clean presets, and installer merge/backup/dry-run behaviour, on Python 3.13 and 3.10 from a fresh download.

The simulator models the documented rules; it isn't Claude Code (no hooks, mods, classifier or session approvals, see docs/limits.md). Bash rules match text, not programs, so deny packs are guard rails: use the sandbox preset when a boundary must hold. Not affiliated with Anthropic.